Improper input validation in Xlib - CVE-2018-14598

Vulnerability identifier: #VU14505

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-14598

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to an error when handling malicious input. A remote unauthenticated attacker can cause a remote server to return a specially crafted reply to cause the target X client to crash.

Xlib
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Slackware Linux
Opensuse
Fedora
libx11 (Alpine package)
libX11
Dynamic System Analysis (DSA) Preboot
Flex System Chassis Management Module (CMM)

Install update from vendor's website.

libx11 (Alpine package) - update to 1.6.6-r0
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
libX11 - update to 1.6.7-1.fc28
Flex System Chassis Management Module (CMM) - update to 2pet18a-2.5.14a

• https://gitlab.freedesktop.org/xorg/lib/libx11/commit/e83722768fd5c467ef61fa159e8c6278770b45c2

• Multiple vulnerabilities in X.org libX11
• Slackware Linux update for libX11
• OpenSUSE Linux update for libX11
• OpenSUSE Linux update for libX11
• Gentoo update for X.Org X11 library
• Red Hat update for Xorg
• Improper input validation in libx11 (Alpine package)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 28 update for libX11